Monday, June 13, 2016

Panasonic Video Titler VW-KT300 - part 2

In previous post we show the Panasonic VW-KT300 and its internals. We saw that it have a Yamaha V9958 videochip and a Z80 compatible CPU, but we still couldn't say it's a hidden MSX: there is a lot of machines that shares the same CPU and VDP of MSX1 and aren't MSXs, this could be the case here (but with MSX2+ components). So, there is a need to look the ROM contents to see if this video titler follows the MSX architecture and not only makes use of MSX's related LSIs.

The FS-VA1 ROM placement have the
"Program ROM" label on PCB

Tabajara did read the ROM identified as FS-VA1 and sent to me the output file. Running "strings" on this ROM file, we didn't found any of the MSX character strings: no "Microsoft", nor "MSX", not even a "Copyright" notice. That file wasn't an MSX BIOS, but I still did need to determine what it was and how it works. How this ROM program drives the video titler hardware.

The VW-KT300 "BIOS"

The ROM dump had 256KB, as the Z80 have a 64KB address space, usually the disassemblers processes files with 64KB maximum size. So, the first thing that I did was to split the original 256KB file in many 16KB chunks. That size choice wasn't a technical one, it was more related with my bias towards MSX architecture, so I guessed that the MSX page size would be a good size to split the file. The next steps proved that, this time, I did a good choice :)

I ran "hexdump" on the first chunk and got this (removed spaces so it can fit on screen):

Hey, there is something different here. A label. I did the same in the other files and I found many labels. Some of the 16KB blocks didn't have any label, but most have. And one of them have a MSX cartridge header!

The code that we read until now does: if it's a cold boot, initialize the memory mapper registers, activate page 0 on slot 0 and pages 1, 2, 3 in slot 3.0. The disassembled code follows the boot sequence and shows the PSG and VDP initialization, the filling of system variables in page 3 with the expected values, etc.

With this information, we can say the Panasonic VW-KT300 is a MSX compatible machine with a very customized BIOS. Tabajara confirmed that assumption using the Expert 1.3 ROM (MSX1 + Mapper initialization) and we can see the results on this video:

As we saw in the video, the boot runs OK and we end with the MSX-BASIC prompt on screen.

While the confirmation of this machine being MSX compatible is good news, it raises some questions about why it was built this way. We have good signs that this machine was designed and released in 1989/1990.

You can see the "MADE IN JAPAN - 1989" silk on PCB.
And in FS-VA1 ROM the year of "1990"

All the last MSX models from Panasonic (FS-A1FM, FS-A1FX, FS-A1WX, FS-A1WSX, FS-A1ST and FS-A1GT) uses versions of Toshiba T9769 MSX-Engine, which integrates the PSG, PPI, Mapper, glue logic and a high speed Z80. Why not use it in VW-KT300?

The inside machine looks like a mishmash of stuff that Matsushita had lying in their warehouse (the reused ROMs talks a story here). But, at same time, the VW-KT300 doesn't use the common platform of all last MSX models from Panasonic: it uses a Z80B from Zilog with a custom gate array instead of the T9769, and have a full rewritten BIOS! Why not follows the Sony's path and uses the MSX BIOS and the titler software over it?

Well, continuing our journey to understand this machine's BIOS, next step was to find the slot layout to boot this machine in MSX2+ mode :). First we modified the CBIOS to include a small subroutine to look each page in each slot and show the contents of the first bytes on screen. We got that chart:

Probably I did something wrong in my page switching code and the test hangs when reading data from PAGE3. Well, at least, with the chart we rebuild the EPROM with the ROMs from A1FX, the BIOS+BASIC in place of SYSTEM0 and SAMPLE0, MSX2+ SUBROM instead of SAMPLE1 and KANJI-ROM Driver where we have DEMO in original ROM.

And... that new ROM doesn't works :(

The layout of SLOT3.3, with all pages mapped to EDIT0, is a clue that there is a custom mapper that needs to be configured somehow. No ideas here. Need to go back to disassembler to search for exotic code, like the one that begins in 0221h which sends some data to switching ports (comments and label names by me):

After this ports configuration, it reads N bytes from port 45, comparing it with two strings: 'MOUF1' and FFhFFh'GOT48'. I didn't found those strings in main ROM, maybe that read from port 45 reads one of the Kanji-ROMs or the dictionary?

These jumps and subroutine calls shuffles the ROM's pages between the frames and subslots of SLOT3, writing in not usual memory locations inside these subroutines. After the initial shuffle, the BIOS reads the N bytes from 4010h and compares with some strings:

The character strings to be compared are SYSTEM0, SYSTEM1, VA1DATA, EDIT0, EDIT1, EDIT2, EDIT3, SAMPLE0, SAMPLE1, SAMPLE2, SAMPLE3, SAMPLE4, SAMPLE5, SAMPLE6, SAMPLE7, SAMPLE8, SAMPLE9, DEMO, DESIGN, AUTOSTART and SCENARIO. Some of those strings are the labels that we found in the ROM blocks. And others... are from the IC Card? The SRAM? From other equipment?

Just below the labels, there are a few more strings that doesn't seem to be used by or called anywhere in the code:

ASOH HIRONAKA NAKATA HAYASHI FURUKI

My guess is that these are the names of creators of this machine and BIOS.

At the end, this code to scramble and reallocate the pages left me very confused. After many attempts, I threw in the towel and stopped my efforts to understand what is happening in this code. If you want to try to continue, the tarball with all the ROMs (the full dump and split in blocks) can be downloaded from here, you can also download SYSTEM0 already disassembled and partially commented by me. Maybe it helps.

I hope someone can understand this page mapping code. It would be nice to boot this machine in MSX2+ mode and read games from the IC Card :D